{"id":"CVE-2026-115909","kind":"vulnerability","aliases":["CVE-2026-115909"],"related":[],"title":"zip Rust crate: crafted archive aborts process via huge allocation","description":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0.","summary":"The zip Rust library, versions 1.3.0 through 8.x, calls Vec::with_capacity on a symbolic link target sized from an attacker-controlled ZIP64 uncompressed size before validating the entry. A small malicious archive makes the process abort, and catch_unwind cannot contain it, so an attacker can repeatedly crash archive-processing services.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["archive-processing","cargo","file-upload","package","rust","zip"],"not_affected_if":["no-untrusted-archives","version-9-or-later"],"how_to_check":"- Check the locked version of the zip crate with `cargo tree -i zip` or by reading `Cargo.lock`\n- Look for `zip` versions from `1.3.0` up to but not including `9.0.0` in `Cargo.lock`","fix":"- Upgrade the zip crate to `9.0.0` or later with `cargo update -p zip`\n- Rebuild and redeploy services that extract untrusted ZIP archives","status":"open","published_at":"2026-10-26T17:17:18+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","triaged_at":"2026-10-26T17:33:09+00:00","updated_at":"2026-10-26T17:33:09+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T17:33:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the zip crate to `9.0.0` or later with `cargo update -p zip`\n- Rebuild and redeploy services that extract untrusted ZIP archives","reach":"internet","title":"zip Rust crate: crafted archive aborts process via huge allocation","impact":"medium","summary":"The zip Rust library, versions 1.3.0 through 8.x, calls Vec::with_capacity on a symbolic link target sized from an attacker-controlled ZIP64 uncompressed size before validating the entry. A small malicious archive makes the process abort, and catch_unwind cannot contain it, so an attacker can repeatedly crash archive-processing services.","category":"package","nicknames":[],"who_cares":["rust","zip","cargo","file-upload","archive-processing"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Remote process abort causes repeated denial of service","analyst_note":"","how_to_check":"- Check the locked version of the zip crate with `cargo tree -i zip` or by reading `Cargo.lock`\n- Look for `zip` versions from `1.3.0` up to but not including `9.0.0` in `Cargo.lock`","needs_analyst":false,"not_affected_if":["no-untrusted-archives","version-9-or-later"],"who_is_affected":"Applications written in Rust that use the zip crate's ZipArchive::extract to process ZIP archives from untrusted sources, such as upload handlers or file ingestion services. Projects that only write ZIP files or only read archives they produce themselves are less exposed. Services that never extract user-supplied archives can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00064,"input_tokens":3410,"output_tokens":597,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115909':13A,16A '-2026':12A,15A '1.3.0':32B,98C '8':34B '9.0.0':100C,176C 'abort':6A,65B,140C 'alloc':10A,137C 'allow':160C 'applic':169C 'archiv':5A,18B,61B,79B,128C,167C 'archive-process':17B,78B,166C 'attack':49B,74B,117C 'attacker-control':48B,116C 'call':36B,105C 'cannot':69B,150C 'capac':39B,108C,133C 'cargo':20B 'catch':67B,154C 'caus':134C 'contain':70B,152C 'control':50B,118C 'craft':4A 'crash':77B 'crate':3A 'cve':11A,14A 'data':125C 'denial':162C 'entri':57B,124C,145C 'extract':102C 'failur':149C 'file':22B,96C 'file-upload':21B 'fix':173C 'huge':9A 'imposs':132C 'infal':136C 'issu':171C 'librari':30B,86C 'link':43B,112C 'make':62B 'malici':60B 'packag':24B 'path':138C 'process':7A,19B,64B,80B,142C,168C 'read':91C,123C 'repeat':76B,161C 'request':130C 'rust':2A,25B,29B,88C 'servic':81B,164C 'simpl':94C 'size':45B,53B,121C 'small':59B,127C 'src/read/mod.rs':104C 'support':90C 'symbol':42B,111C 'target':44B,113C 'thread':159C 'uncompress':52B,120C 'unwind':68B,155C 'upload':23B 'use':114C 'valid':55B,147C 'vec':37B,106C 'version':31B,175C 'via':8A 'worker':158C 'write':93C 'x':35B 'zip':1A,26B,28B,82C,85C,95C 'zip64':51B,119C 'ziparch':101C","nicknames":[],"mitigations":[],"who_affected":"Applications written in Rust that use the zip crate's ZipArchive::extract to process ZIP archives from untrusted sources, such as upload handlers or file ingestion services. Projects that only write ZIP files or only read archives they produce themselves are less exposed. Services that never extract user-supplied archives can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T17:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115909","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115909","severity":null,"published_at":"2026-10-26T17:17:18+00:00","modified_at":"2026-10-26T17:17:18+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","fetched_at":"2026-10-26T17:31:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}